Active exploitation of two critical remote code execution flaws tracked as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) has been confirmed in production environments. Adel Karimi, detection and response lead at Perplexity, documented the successful attack through honeypot telemetry capturing verified code execution against an Apache mod_php deployment running PHP 8.4.26.
Karimi's technical analysis revealed sophisticated attack mechanics beyond simple crashes. "This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process. The response delivered an 800 KiB decoded cookie dump, and a function address derived from that dump using the public exploit's offsets appears in the subsequent execution payload," Karimi shared. The attacker executed shell commands approximately 1.6 milliseconds after the exploitation request completed.
Marcus Hutchins, a threat researcher at Expel tracking PHP2Shell exploitation reports, corroborated the findings. "This is by far the highest quality confirmation of in-the-wild php2shell exploitation I've seen so far. Deep technical breakdown of a successful exploitation attempt against an Apache mod_php installation running PHP 8.4.26," Hutchins stated.
Timeline of disclosure and patching
The PHP security team released patches on Wednesday, October 21, one day after notifying administrators to prepare for immediate deployment. Although vulnerability details and proof-of-concept code circulated online before patches became available, the PHP team maintained that no functional exploits existed at that time.
Multiple security vendors including Cloudflare, Hadrian, watchTowr, Previdian, and Patchstack detected exploitation attempts prior to public disclosure, but all were unsuccessful. Amazon Threat Intelligence researchers identified attackers probing for PHP2Shell vulnerabilities four days before patches shipped. According to Dataminr's Threat Research and Cyber Engineering team, early attack activity "limited to scanning, fingerprinting, and use of non-working exploits, with no known compromises" until Karimi's confirmed breach.
Additional vulnerability and mitigation guidance
The PHP security team disclosed a third RCE vulnerability (CVE-2026-115560) on Friday with no available patch. This flaw requires "an unusual combination of configuration and application code" to be exploitable. Until a patch is released, administrators should set session.upload_progress.enabled=0 to prevent attacks, a mitigation measure previously recommended for the PHP2Shell vulnerabilities.
Scale of exposure
PHP powers approximately 70% of all websites globally. Current estimates from VirusTotal indicate more than 5.1 million PHP hosts are exposed online, with roughly 3.8 million having at least one port accessible to remote attacks.